fix(performance): replace untrusted airspeeds instead of dropping rows (audit I1, I9, I14)

docs/explanation/input-prioritization.md

@@ -54,7 +54,7 @@ graph TD
 
 | AO provides | BADA calculation | Aircraft mass | Fuel flow | Engine efficiency |
 | --- | --- | --- | --- | --- |
-| Fuel flow, engine η and aircraft mass | none (see low-speed points below) | AO | AO | AO |
+| Fuel flow, engine η and aircraft mass | none (see untrusted airspeeds below) | AO | AO | AO |
 | Aircraft mass, with at most one of fuel flow and engine η | thrust and fuel flow | AO | AO if provided, else from the AO mass decrease | AO if provided, else BADA |
 | TOW, no aircraft mass | thrust and fuel flow | AO TOW, decreased with the BADA fuel flow | AO if provided, else BADA | AO if provided, else BADA |
 | Neither aircraft mass nor TOW | thrust and fuel flow | iterative estimate (below), decreased with the BADA fuel flow | AO if provided, else BADA | AO if provided, else BADA |
@@ -77,8 +77,8 @@ graph TD
 !!! note "Fuel-burn plausibility check"
     A flight is rejected when its total fuel burn, with the fuel flow actually used (AO, derived from the mass, or BADA), exceeds 1.2 × (MTOW − OEW). A flight rejected by this check goes through the retries described in [BADA Type Mapping](#bada-type-mapping): BADA 3, then (when the flight has points below FL20) the calculation without those points. It fails only if every attempt is rejected. The check is not applied when fuel flow, engine efficiency and aircraft mass are all provided. A BADA fuel flow above 100 kg/s, negative or not a number at a point counts as a BADA failure at that point (the point takes the values of the previous point; more than 5 such points in a row make the attempt fail); AO fuel flow is not checked point by point.
 
-!!! note "Low-speed points"
-    Before any of the cases above, points whose true airspeed is below the BADA stall speed (at MTOW, take-off configuration), or that have no true airspeed, are removed, also when the AO provides fuel flow, engine efficiency and aircraft mass. If more than 80 % of the points would be removed, none are. Currently this applies only to aircraft computed with BADA 3; this filter is under review.
+!!! note "Untrusted airspeeds"
+    Before any of the cases above, also when the AO provides fuel flow, engine efficiency and aircraft mass, the true airspeed of each point is checked. It is untrusted when it is missing, when its calibrated airspeed is below the BADA stall speed (at MTOW, take-off configuration by default; parameter `airspeed_stall_config`) or above the aircraft's maximum operating speed (the BADA VMO, with no margin; 400 kt when the BADA model gives none), or when its Mach number is 1 or more. The Mach limit is not the maximum operating Mach number (BADA MMO): the true airspeed comes from the ground speed and a modelled wind, so a normal cruise can show a few hundredths above MMO (a wind error of 10 kt at FL370 is about Mach 0.017), and some BADA models stand for a faster aircraft type. No point is removed: an untrusted true airspeed is replaced by linear interpolation in time between the nearest trusted points. Before the first or after the last trusted point, it takes the calibrated airspeed of that trusted point, converted back to true airspeed at the point's own altitude and temperature, so a descent after the last cruise point keeps a constant calibrated airspeed and its true airspeed falls with the altitude. The acceleration is recomputed from the result. When PyNeats computes the true airspeed from the ground speed and the wind, the check and the replacement use the 1-minute speed before smoothing. The replaced series is then smoothed with the same filter (7 points), and the result is used only at the points whose smoothing window contains an untrusted point: the replaced points, their neighbours up to 3 points away, and the first or last 3 points of the flight when one of its first or last 7 points is untrusted. The true airspeed of those neighbours can change by tens of knots, or more next to a slow stretch, because the original smoothing had pulled them towards the slow minutes. Untrusted points before the first or after the last trusted point keep the calibrated airspeed of that trusted point after the smoothing too, so the smoothing does not extend a climb or descent over them. All other points keep their true airspeed exactly, and a flight without an untrusted point keeps its true airspeed, except at the last point, which has no next point and takes the true airspeed of the point before it. The output `true_airspeed` is the value after this step; the output columns are unchanged. Known limits: a too-fast minute that is not above VMO, such as a "catch-up" minute near the runway after a frozen position (for example at a calibrated airspeed between 250 kt and VMO), stays trusted, and the points before or after it take its calibrated airspeed. The first and last trusted points can take the smoothed value while the points held before or after them keep its unsmoothed calibrated airspeed, so the speed can step there and the acceleration has a one-point spike. A flight fails, without the BADA 3 and FL20 retries, when more than 80 % of its time has an untrusted true airspeed, or when the check itself fails. When the AO provides fuel flow, engine efficiency and aircraft mass, the BADA fuel flow is not used, so the 80 % rule does not fail the flight: its true airspeed is still replaced (or kept as is when no point is trusted).
 
 ---
 

docs/explanation/mrv-specification.md

@@ -178,7 +178,7 @@ The performance model is used to estimate these values when the AO does not prov
 
 #### Basic Parameterisation
 
-- If TAS is not provided by the AO, it is computed from the (smoothed) ground speed and the wind fields, available **above 840 hPa (FL050)**; where no wind is available (below that level) the wind is set to 0, so TAS equals the smoothed ground speed.
+- If TAS is not provided by the AO, it is computed from the (smoothed) ground speed and the wind fields, available **above 840 hPa (FL050)**; where no wind is available (below that level) the wind is set to 0, so TAS equals the smoothed ground speed. Implausible TAS values (provided or computed) are replaced before BADA is run (see rule 4 of the Input Decision Logic).
 - The International Standard Atmosphere is corrected with actual air above 550 hPa, backfilling and forward-filling the correction for lower altitudes.
 - BADA flight phases are determined from **vertical speed** using simple decision thresholds.
 
@@ -196,7 +196,7 @@ Each performance quantity has its own source, so the cases below are not exclusi
 
     A quantity counts as provided when at least one point has a value; points left empty are not filled from BADA and are left out of the fuel totals.
 
-    Before any of these rules, points whose true airspeed is below the BADA stall speed (at MTOW, take-off configuration), or that have no true airspeed, are removed, also on the path of rule 2; if more than 80 % of the points would be removed, none are. Currently this applies only to aircraft computed with BADA 3; this filter is under review.
+    Before any of these rules, also on the path of rule 2, a true airspeed is untrusted when it is missing, when its calibrated airspeed is below the BADA stall speed (at MTOW, take-off configuration by default) or above the BADA maximum operating speed (VMO, no margin; 400 kt when the BADA model gives none), or when its Mach number is 1 or more. No point is removed: an untrusted true airspeed is replaced by linear interpolation in time between the nearest trusted points; before the first and after the last trusted point it takes the calibrated airspeed of that point, converted to true airspeed at its own altitude. The acceleration is recomputed. A computed true airspeed is checked and replaced on the 1-minute speed before smoothing, then smoothed with the same 7-point filter; the smoothed value is used at the replaced points (not before the first or after the last trusted point, which keep the calibrated airspeed of that point) and at the points within the smoothing window of a replaced point (up to 3 points away), which can change too. All other points, and every point of a flight without an untrusted point, keep their true airspeed (the last point, which has no next point, takes the value of the point before it). The output `true_airspeed` is the value after this step. A flight fails, with no retry, when more than 80 % of its time is untrusted, except on the path of rule 2 (BADA fuel flow not used), where the flight is kept with its true airspeed replaced.
 
 5. **Neither mass nor TOW provided:** the load factor is used (AO-provided or conservative default of 1). The following approach (similar to PyContrails) is applied: